Skip to content

Commit d8f4818

Browse files
tashiantashian
authored
Merge pull request #441 from smallstep/carl/google-workspace
Google Workspace setup and wi-fi guides
2 parents d02d3cc + 7f766fd commit d8f4818

File tree

3 files changed

+120
-11
lines changed

3 files changed

+120
-11
lines changed

‎manifest.json‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,17 @@
4545
"path": "/platform/smallstep-agent.mdx"
4646
},
4747
{
48-
"title": "Connect Jamf Pro",
49-
"path": "/tutorials/connect-jamf-pro-to-smallstep.mdx"
48+
"title": "Connect Google Workspace",
49+
"path": "/tutorials/connect-google-workspace-to-smallstep.mdx"
5050
},
5151
{
5252
"title": "Connect Intune",
5353
"path": "/tutorials/connect-intune-to-smallstep.mdx"
5454
},
55+
{
56+
"title": "Connect Jamf Pro",
57+
"path": "/tutorials/connect-jamf-pro-to-smallstep.mdx"
58+
},
5559
{
5660
"title": "Connect Workspace One UEM",
5761
"path": "/tutorials/connect-workspace-one-to-smallstep.mdx"
@@ -78,14 +82,14 @@
7882
"title": "Set up Wi-Fi Access Points for EAP-TLS",
7983
"path": "/tutorials/wifi-setup-guide.mdx"
8084
},
81-
{
82-
"title": "Deploy EAP-TLS Wi-Fi with Jamf Pro",
83-
"path": "/tutorials/apple-mdm-jamf-setup-guide.mdx"
84-
},
8585
{
8686
"title": "Deploy EAP-TLS Wi-Fi with Intune",
8787
"path": "/tutorials/intune-mdm-setup-guide.mdx"
8888
},
89+
{
90+
"title": "Deploy EAP-TLS Wi-Fi with Jamf Pro",
91+
"path": "/tutorials/apple-mdm-jamf-setup-guide.mdx"
92+
},
8993
{
9094
"title": "Wi-Fi Authentication Webhooks",
9195
"path": "/tutorials/wifi-authentication-webhooks.mdx"

‎step-ca/acme-basics.mdx‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
updated_at: October 02, 2025
2+
updated_at: October 20, 2025
33
title: ACME Basics
44
html_title: ACME Protocol Basics for step-ca Users
55
description: Learn ACME protocol fundamentals for step-ca. Implement automated certificate management using industry-standard protocols.
@@ -42,10 +42,23 @@ This tutorial assumes you have initialized and started up a `step-ca` server (se
4242
With ACME, machines can get certificates from a CA without any human interaction involved.
4343
It is used by public Web PKI CAs (eg. Let's Encrypt) and by private, internal CAs.
4444

45-
ACME allows the CA to prove that a client controls a set of resources for the purpose of certificate issuance.
46-
ACME doesn't restrict _who_ can make requests of the CA.
47-
There is an extension to ACME called External Account Binding (EAB) which adds keys for ACME accounts,
48-
and this feature is available in Smallstep's commercial CA software.
45+
ACME allows the CA to prove that a client controls an identifier
46+
(a domain name, for example)
47+
for the purpose of authorizing a certificate request.
48+
However, ACME can't determine whether a client
49+
is the rightful owner of the identifier,
50+
or merely an entity currently controlling it.
51+
52+
ACME's security model relies heavily on DNS and network security.
53+
An ACME administrator must ensure
54+
that host IP assignment and DNS resolution
55+
are appropriately secured.
56+
And in some organizations,
57+
an additional client credential acts as a useful backstop here.
58+
There is an extension to ACME called External Account Binding (EAB)
59+
which adds an authorization layer,
60+
using pre-registered client credentials.
61+
This feature is available in Smallstep's commercial CA software.
4962

5063
## A Typical ACME Flow
5164

‎tutorials/connect-google-workspace-to-smallstep.mdx‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
updated_at: October 21, 2025
3+
title: Connect Google Workspace to Smallstep
4+
html_title: Integrate Google Workspace with Smallstep Tutorial
5+
description: Integrate Google Workspace with Smallstep for Chromebook device security. Complete guide for enforcing device trust in ChromeOS environments.
6+
---
7+
8+
Smallstep can integrate with Google Workspace to keep your ChromeOS device inventory in sync.
9+
10+
# Prerequisites
11+
12+
You will need:
13+
14+
- A [Smallstep team](https://smallstep.com/signup)
15+
- A Google Workspace tenant, with ability to manage domain-wide delegation
16+
- A Google Cloud project, with ability to create service accounts and keys
17+
18+
# Step-by-step instructions
19+
20+
In Google Cloud Console, select a project you will use for Smallstep. This can be any project, as long as you can grant domain-wide delegation to the client in a future step.
21+
22+
Your Google Cloud project must have the Admin SDK API enabled. By default, it is disabled.
23+
24+
### 0. Enable Admin SDK API
25+
26+
1. Go to [Admin SDK API](https://console.cloud.google.com/apis/api/admin.googleapis.com) for your project, and choose **Enable API**
27+
28+
### 1. Create a Service Account for Smallstep
29+
30+
1. In Google Cloud, visit [IAM & Admin → Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)
31+
2. Choose **Create service account**
32+
3. Set a **Service account name**, e.g. `Smallstep Google Workplace Sync`
33+
4. Optionally, provide a **Description** for the account
34+
5. Choose **Done**
35+
6. Open the details for the Service Account you just created
36+
7. Copy the **Unique ID** (numeric) and the **Email** shown on the details tab; you’ll need them later
37+
8. Visit the **Keys** tab, and choose **Add key**, then **Create new key**
38+
9. Choose **Create** to create a JSON key
39+
40+
A file containing the service account key will be downloaded. Keep this safe and secure!
41+
42+
### 2. Grant device directory API permissions
43+
44+
1. In Google Admin, visit [Security → Access and data control → API controls](https://admin.google.com/ac/owl)
45+
2. Under Domain wide delegation, select **Manage Domain Wide Delegation**
46+
3. In the **API Clients** table, select **Add new**
47+
1. Enter the **Unique ID** of the service account from Step 1
48+
2. For the **OAuth Scopes**, enter the following scope:
49+
50+
```
51+
https://www.googleapis.com/auth/admin.directory.device.chromeos
52+
```
53+
54+
3. Choose **Authorize**
55+
56+
### 3. Add Google Workspace to Smallstep
57+
58+
In Smallstep, visit [Settings → Device Management](https://smallstep.com/app/?next=/settings/devices).
59+
60+
Configure a new Google Workspace Integration with the following values:
61+
62+
- The **Customer ID** of your Google Workspace tenant. The Customer ID is a short alphanumeric string. It can be obtained from the Google Workspace Admin [Account Settings](https://admin.google.com/ac/accountsettings/profile) page
63+
- The **Service Account JSON key** you downloaded earlier
64+
- An email address of a user in your Google Workspace directory with admin permissions
65+
66+
### 4. Add Smallstep Certificates to Google Workspace
67+
68+
After saving the Google Workspace connection, you will see settings for your integration.
69+
70+
1. Download the following Authority Certificates:
71+
- Smallstep Devices Root CA
72+
- Smallstep Devices Intermediate CA
73+
- Smallstep Agents Root CA
74+
- Smallstep Agents Intermediate CA
75+
76+
2. In Google Workspace, visit [Devices → Networks → Certificates](https://admin.google.com/ac/networks/certificates).
77+
3. Choose an Organizational Unit, if desired
78+
4. Choose **Add certificate**
79+
80+
In the modal, configure the following:
81+
82+
- Provide a descriptive name, e.g. `Smallstep Devices Root`
83+
- Upload the PEM file for the Smallstep Devices Root CA
84+
- Check ✅ **Enabled for Chromebook**
85+
- Choose **Add**
86+
5. Repeat Step 4 for each of the certificates you downloaded
87+
88+
### Confirmation
89+
90+
Within a few minutes, you should see all of your ChromeOS devices in Smallstep's [Devices](https://smallstep.com/app/?next=/devices/all) tab.
91+
A full sync is performed every 8 hours, and a partial sync every hour.
92+

0 commit comments

Comments
 (0)